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DIGITALEUROPE, the industry association representing the digital technology industry in Europe, fully 
endorses the objectives of the European Commission to safeguard and promote human rights. 
Furthermore, DIGITALEUROPE fully supports the European Commission’s proposal to reform the export 
control regime in order to address the latest technological and political developments. DIGITALEUROPE 
recollects that the EU currently has a well-functioning export control system, implementing the results 
from the international export control regimes, also used by many third countries as a model and best 
practice. This system has been tested in practice for a long time and provides a solid legal baseline for 
exporters and Member States. 


DIGITALEUROPE acknowledges the efforts of the European Parliament (hereafter: EP) to advance the 
Commission’s proposal for a modernization of the EU Export Control Regime. Following the plenary vote 
of the EP on 17 January 2018, we encourage the EP and Council to stand ready to work towards a legally 
sound and operational export control regime in line with the international best practices and export 
control regimes. 


On the basis of the efforts of the EP, and in light of the ongoing discussions in the Council of the 
European Union, we deem it necessary to continue working on the proposed text. It is important that 
the principles and goals of the export control regime as well as legitimate business and societal interests 
can benefit from the reform in practice and any unintended consequences are prevented. 
Consequently, this paper sets out our suggestions for changes to the proposed Regulation following the 
vote in EP plenary on 17 January 2018. 


1) Scope and Definitions 





DIGITALEUROPE believes that the existing dual-use definition should continue being based on the 
internationally established definition. DIGITALEUROPE therefore appreciates the EP’s efforts to clarify 
the difference between traditional dual-use items and cyber surveillance items. The definition of cyber- 
surveillance items as such is now more detailed and comprehensible. While recognizing these 
improvements, we believe that any explanation of what covert intrusion is, must include consent by 
owner/administrator of systems rather than the owner of the data exclusively. In order not to 
compromise the primary objectives of the multinational export control system, there must be 
consistency between the definition and the annex in this regard as well as with the Wassenaar 
Arrangement Dual-Use Goods and Technologies list. 
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2) General Export Authorisations 





DIGITALEUROPE welcomes the EP’s strong support for the introduction of the new EU General 
Authorisations (hereafter: EUGEAs) for encryption and intra-company transfers, putting the EU’s 
industry on the same competitive level as many of our trading partners. Since encryption functionalities 
are widely available on a global level to individuals and businesses to secure information, the licensing 
simplification for products from category 5 part 2 is fully justified. Similarly, the simplification for intra- 
company transfers of software and technology will have a positive impact on global collaboration when 
the dissemination of such software and technology is under control of the same corporation. We would 
appreciate if the EU General Authorization also covered equipment, hardware and materials e.g. 
laboratory equipment and prototypes, which are often moved internationally during global R&D 
projects. As the export of software and technology already benefits from similar licensing simplification, 
itis unclear to us where the additional risk should come from. There is nothing inherent in products that 
would put them at higher risk than software and technology. 


In relation to the EUGEA for export after repair/replacement, the existing exception to this EUGEA 
should only be applicable when the warehouse is not under the control of the EU exporter (see para 2 
point 3 in the EUGEA). This clarification would enable exporters that ship to depots which are under 
their control benefit from the general authorisation whilst keeping the risk of diversion at a minimum. 
Shipping to depots is necessary in order to be able to service customers with very short response times 
(down to two hours) for instance in the networking industry to avoid network outage. This clarification 
to the “warehouse exception” should equally be applied in all other EUGEAs. 


3) Disproportionate Measures 





DIGITALEUROPE notes the EP’s strong support for the introduction of new EUGEAs for encryption and 
intra-company transfers, and recognises the need to limit the catch-all clause. Nevertheless, a 
proportionate balance must be achieved with measures for cybersurveillance technologies to avoid 
unintended consequences that could limit legitimate activity to ensure security of network and 
information systems. Such new control measures can only be effective when specific end-users and/or 
countries of concern are targeted. In our view, industry does not have sufficient information to take 
such important decisions. Governments are much better prepared to identify actors that violate or are 
likely to violate human rights, having access to information from sources not available to private 
companies, and other means to assess the political situations in specific countries. DIGITALEUROPE 
welcomes an opportunity to engage in continued dialogue with policy makers to better understand such 
a balance and any unintended consequences. 


4) Autonomous List: Unilateral Regime and Disproportionate Power 





Next to the extended definition of dual-use items to include cyber surveillance technologies, Annex |.B 
includes a new set of products with cyber surveillance technology. These products are set apart from 
traditional dual-use products that reflect the control lists of other export control regimes of other 
countries outside of Europe. DIGITALEUROPE regrets this proposed shift away from international 
regimes and urges Member States to reconsider the appropriateness of this element of the Commission 
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proposal. DIGITALEUROPE strongly reiterates that unilateral regimes harm the global competitiveness 
of the European industry and ignore existing international export control regimes. Furthermore, failure 
to successfully negotiate such technology to be controlled by the recognised international regime is 
unlikely to see a significant improvement in human rights violations, as the cyber surveillance 
technology can simply be procured and exchanged outside of the European Union. 


Absent a full re-alignment with the international control regimes, DIGITALEUROPE considers the 
introduction of safeguards to prevent a future deviation of an EU autonomous list from these regimes 
essential. Should the Commission in the future wish to amend the list of dual-use items set out in Section 
B of Annex |, the Commission should be obligated to take into account the ability to make a clear and 
objective specification of the item as well as the foreign availability of the item outside of the European 
Union. The ability to control effectively the export of the item and the controls by the international 
export control regimes should also be taken into account (in line with former EPP amendment 301). 


5) Internal Compliance Programme and Due Diligence 





Introducing Internal Compliance Programme (ICP) requirements as one of the conditions of the global 
export authorizations and the Union General Export Authorization EUOO8 for intra-company 
transmissions of software and technologies seems to be justified. 


Nevertheless, the mandatory ICP certification proposed by the EP would be an additional administrative 
burden for exporters (even if free of charge). Many multinational organizations have their global ICP 
and such programme should be accepted without the additional mandatory need to create separate 
ICP documentation in the EU (except when EU specific standards should be met, which can be addressed 
e.g. in the annex). Any ICP requirements in the EU should be aligned with international best practices as 
much as possible. 


DIGITALEUROPE supports the ICP elements outlined in the draft ICP guidelines with the exception of 
“ohysical and technical security”. We are of the opinion that there should be a great level of flexibility 
in the implementation of ICP best practices given that there is no “one-size-fits-all” solution. Depending 
on the size, structure and volume of export of each organization, there are different ways to achieve 
compliance standards outlined in the ICP. 

A similar approach should apply to due diligence guidelines which should be aligned with ICP as much 
as possible. 


6) New Decision Criteria for Export Authorisations 





The list of decision criteria that an export control authority shall take into account when deciding 
whether or not to grant an export authorisation has been expanded significantly (Art. 14). It is difficult 
to anticipate the practical outcome of these many new decision criteria for export authorisations as they 
are rather subjective and not clearly connected to the dual-use items to be exported. It is likely that the 
criteria will be interpreted differently by the competent authorities and that the level-playing field 
within the EU will decrease. DIGITALEUROPE supports a continued practice of applying, when relevant, 
the criteria of Common Position 2008/944/CFSP which includes human rights. 
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7) Authorisations for Technical Assistance 





The definition of technical assistance creates the risk of capturing routine business activities such as 
consulting and skills courses. This definition should be narrowly constrained. There should be no 
extraterritorial controls that would be inconsistent with international law and with the EU’s opposition 
to the exercise of such controls by the US. DIGITALEUROPE is of the opinion that paragraphs 1 and 2 of 
Article 7 shall not apply if the technical assistance (a) is provided in a country listed in Section A of Annex 
Il, (b) takes place via the passing on of information, which is generally available or forms part of basic 
research within the meaning of the General Technology Note to Annex | or Section A of Annex |, (c) does 
not refer to technology, which is cited in the numbers of category E of Annex |, or (d) represents the 
absolutely necessary minimum for the construction, operation, maintenance and repair of those dual- 
use items for which an export authorisation was issued. 


8) Harmonization of export licensing across the EU 





We fully recognize that the harmonization of export control systems across the EU is vital. Therefore, we 
support the implementation of an EU-wide processing time of 30 days for global and individual export 
authorizations with the possibility of extending it in duly justified cases by additional 30 days. 

While the proposed EU-wide validity period of 2 years for global and individual export authorizations is 
an improvement compared to the previous text of the draft regulation (1 year proposed by the 
European Commission), we would welcome an extension to 3 years. This would illustrate administrative 
simplification for both authorities and exporters (especially, given that authorities have the power to 
cancel authorizations at any time in duly justified cases). 


DIGITIALEUROPE is ready to continue working constructively with policy-makers to make sure Europe 
can lead in the global fight for human rights whilst providing a legally sound and operational export 
control regime for its ICT industry to remain globally competitive. 
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ABOUT DIGITALEUROPE 


DIGITALEUROPE represents the digital technology industry in Europe. Our members include some of the world's largest IT, 
telecoms and consumer electronics companies and national associations from every part of Europe. DIGITALEUROPE wants 
European businesses and citizens to benefit fully from digital technologies and for Europe to grow, attract and sustain the 
world's best digital technology companies. DIGITALEUROPE ensures industry participation in the development and 
implementation of EU policies. 


DIGITALEUROPE’s members include in total 25,000 ICT Companies in Europe represented by 61 corporate members and 37 
national trade associations from across Europe. Our website provides further information on our recent news and activities: 
http://www.digitaleurope.org 
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Corporate Members 


Adobe, Airbus, Amazon, AMD, Apple, BlackBerry, Bose, Brother, CA Technologies, Canon, Cisco, Dell, Dropbox, Epson, 
Ericsson, Fujitsu, Google, Hewlett Packard Enterprise, Hitachi, HP Inc., Huawei, IBM, Intel, JVC Kenwood Group, Konica 
Minolta, Kyocera, Lenovo, Lexmark, LG Electronics, Loewe, Microsoft, Mitsubishi Electric Europe, Motorola Solutions, 
MSD Europe Inc., NEC, Nokia, Nvidia Ltd., Océ, Oki, Oracle, Panasonic Europe, Philips, Pioneer, Qualcomm, Ricoh Europe PLC, 
Samsung, SAP, SAS, Schneider Electric, Sharp Electronics, Siemens, Sony, Swatch Group, Tata Consultancy Services, 
Technicolor, Texas Instruments, Toshiba, TP Vision, VMware, Western Digital, Xerox, Zebra Technologies. 


National Trade Associations 


Austria: |OO Germany: BITKOM, ZVEI Slovakia: ITAS 
Belarus: INFOPARK Greece: SEPE Slovenia: GZS 
Belgium: AGORIA Hungary: IVSZ Spain: AMETIC 


Bulgaria: BAIT 

Cyprus: CITEA 

Denmark: DI Digital, IT-BRANCHEN 
Estonia: ITL 

Finland: TIF 

France: AFNUM, Force Numérique, 
Tech in France 
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Italy: Anitec-Assinform 

Lithuania: INFOBALT 
Netherlands: Nederland ICT, FIAR 
Poland: KIGEIT, PIIT, ZIPSEE 
Portugal: AGEFE 

Romania: ANIS, APDETIC 
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Switzerland: SWICO 

Turkey: Digital Turkey Platform, ECID 
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